UK plans
for the retention of data for 12 months
- UK to introduce data retention for 12 months under "voluntary
code"
- Power to introduce mandatory retention available too
- UK derogates from 1997 EU Directive on privacy and pre-empts
EU decision on data surveillance
The UK government is to introduce a "voluntary code"
for all telecommunication providers to retain communications
data for 12 months. The details of the government's plan is set
out in the "Supplemental Regulatory Impact Assessment: Retention
of communications data" accompanying the planned legislation
in the Anti-Terrorism, crime and security Bill currently before
parliament.

The Assessment
makes quite explicit that this surveillance is not only to cover
"national security" (terrorism) but also "the
prevention or detection of crime or the prosecution of offenders".
While it is currently proposed that data will have to be retained
under a "voluntary code" the Home Secretary will also
"have reserve powers to impose a mandatory code of practice
by order" - by "order" means secondary legislation
passed by parliament "on the nod".

The Assessment
argues that retention of data is needed because business is retaining
less data and:

"combined
with pressure from the privacy lobby, this is leading to a decrease
in data retention overall"

Under the heading
"Civil liberties" the Assessment says that "Mass
retention has obvious civil liberties implications" and
that "A balance must therefore be drawn between security
and privacy" and thus concludes:

"Data
relating to specific individuals under investigation will only
be available if data relating to the communications of the entire
population is retained"

The Assessment says that the recommended period for data retention
will be 12 months (the time-limit discussed in EU working parties)
and will be accessed by "the security, intelligence and
law enforcement agencies". The power will be "reviewed
every two years" and be "discarded if no longer felt
to be necessary" - like all so-called "temporary"
measures it is hard to see the agencies agreeing to give up access
to such intrusive surveillance for the foreseeable future.

The government is, at a stroke, dumping the EU Directive on
data protection and privacy (1997). This only allows data to
be retained for the purpose of billing (ie: for the benefit of
the customer). Like the derogation from the ECHR on the indefinite
detention of terrorist "suspects" the UK government
is reneging on one of the fundamental rights of privacy established
by the EU.

It is also pre-empting the ongoing discussion in the European
Union on the proposal currently before the European Parliament
to update the 1997 directive. The parliament is opposed to the
general retention of data, while the Council of the European
Union (the 15 governments) want to introduce an EU-wide policy
of data retention. The outcome is based on "co-decision",
that is, that the European Parliament and the Council have to
agree on the proposal.

A report by the Council's own Legal Service, dated 12 October,
said that governments have all the power they need to combat
terrorism under the existing 1997 Directive and the proposal
on the table (which leaves Article 15.1 unchanged). The Legal
Service reports also says that any measures adopted under this
Article must be: i) be necessary; ii) cater for pressing needs;
iii) remain proportionate to the legitimate goal being pursued;
iv) include legal guarantees provided to individuals so as to
prevent and penalise arbitrary interference. In its opinion a
derogation under Article 15.1. could not be extended to
cover criminal investigations in general.

The UK government by derogating, yet again, from the obligations
under the 1997 EU Directive on privacy in telecommunications
is claiming justification to combat terrorism while extending
the scope of its powers to cover all criminal investigations
however minor. It remains to be seen whether this position will
be challenged.

&COPY; Statewatch ISSN 1756-851X.Material may
be used providing the source is acknowledged.Statewatch
does not have a corporate view, nor does it seek to create one,
the views expressed are those of the author. Statewatch is not
responsible for the content of external websites and inclusion
of a link does not constitute an endorsement.